fix: patch vulnerabilities and bump outdated dependencies

[waldekmastykarz]

Summary

• carries forward every change from fix: patch vulnerabilities and bump outdated dependencies #7587
• updates cooldown-eligible direct dependencies and security overrides
• applies compatible transitive fixes for @humanfs/node, @xmldom/xmldom, brace-expansion, js-yaml, and undici
• retains Zod 4.5.4 because 4.6.5 breaks the required 100% coverage instrumentation
• leaves major-version upgrades for separate compatibility work

Security status

npm audit reports 0 vulnerabilities.

Not auto-applied

Major updates remain for @azure/msal-node, @types/node, eslint-plugin-mocha, mocha, typescript, and several overrides. Pre-release-only updates for @typescript-eslint were also skipped.

Validation

• npm run build
• npm test
• 16,163 tests passing
• 100% statement, branch, function, and line coverage

Supersedes #7587.

[waldekmastykarz]

Superseded by #7620, which includes all changes from this PR plus the latest cooldown-eligible dependency and vulnerability fixes.